@zhivex-ai/harness 1.0.0-rc.11 → 1.0.0-rc.13

package/CHANGELOG.md

@@ -4,7 +4,47 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
-## 1.0.0-rc.11 - 2026-09-01
+## 1.0.0-rc.13 - 2026-09-03
+
+### Added
+
+- Add console command completion, previewed multiline drafts, active project-context inspection, and bounded digest-checked file attachments for the next task.
+- Keep interactive sessions open after command/provider failures and pass Ctrl+C cancellation to active turns and review groups while preserving unresolved approval batches.
+- Render terminal-safe model text and optionally colored diffs; discard unsolicited input lines instead of replaying them into approval prompts.
+- Add `zhx init` with interactive terminal prompts and deterministic non-interactive flags, plus explicit `--profile <name>` selection for `run`, `chat`, `review`, and `doctor`.
+- Store one provider/model pair per schema-versioned personal profile outside the repository with owner-only directories/files, descriptor-bound no-follow reads, strict size/link/permission checks, and no credential or authority-bearing fields.
+- Add a versioned `init` JSON document and installed-tarball smoke coverage for initialization, profile reuse, precedence, permissions, and secret-free output.
+
+### Fixed
+
+- Persist externally interrupted ordinary turns as cancelled after runtime cleanup, without replacing completed work, pending approvals, or genuine timeouts.
+- Accept explicit null first-page cursors for listing/search tools, keeping opaque cursor validation for subsequent pages.
+- Add bounded in-memory task history, Alt+Enter multiline input, and terminal-safe Markdown presentation.
+- Treat a valid SQLite database created only by `sessions list` as an uninitialized operations store in `doctor`, while continuing to reject partially initialized or incompatible operational schemas.
+
+### Changed
+
+- Preserve the published RC.12 tag, artifact, complete Meta/Qwen/OpenAI representative matrix, npm SHA-512 integrity, and SLSA provenance as immutable historical evidence. The onboarding and diagnostics changes are authorized only for a distinct pending RC.13 artifact.
+- Keep profiles explicit rather than active-by-default. Precedence is CLI flags, selected profile, environment, then built-in defaults; `resume` never accepts a profile and continues to restore the original durable policy.
+
+### Migration from RC.12
+
+No Harness configuration, run-store, session-store, change-envelope, or execution-policy migration is required. Existing invocations behave as before unless they opt into `zhx init` and `--profile`. Profiles contain only schema version, provider, and model; API keys remain environment-owned.
+
+## 1.0.0-rc.12 - 2026-09-02
+
+### Fixed
+
+- Keep `git_diff` read-only even under hostile repository configuration: disable repository-controlled filesystem monitors, external diffs, text conversion, and submodule processing; discover changed paths with NUL-safe output; and render only paths permitted by the Harness hard-ignore and sensitive-name policy.
+- Bind MCP configuration loading to one regular, single-link file descriptor with `O_NOFOLLOW`, a 1 MiB limit, canonical-parent containment, and inode continuity from initial inspection through the stable read.
+
+### Changed
+
+- Expand the security-review inventory from mutation/execution tools to all 28 model-facing tool classes, including repository reads, inspection, skill loading, delegation, and dynamic MCP tools, with a regression that rejects future inventory drift.
+- Require direct mitigation, regression evidence, residual risk, and passing status for every reviewed trust boundary and authority-bearing tool. Non-informational findings now require an owner, disposition, rationale, and HTTPS follow-up; critical/high findings cannot be accepted without mitigation.
+- Preserve published RC.11 as immutable historical evidence while authorizing RC.12 as the new pending candidate required by HAR-HU-03 remediation. No RC.12 artifact, live certification, registry integrity, or provenance is claimed before the exact tag completes the protected workflow.
+
+## 1.0.0-rc.11 - 2026-09-02
 
 ### Fixed
 
@@ -13,7 +53,8 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 ### Changed
 
 - Record the immutable, unpublished RC.10 attempt as failed after its exact tarball passed artifact binding: Meta completed 14/14 representative cases, Qwen completed 13/14, and an OpenAI account-funding issue surfaced as retryable HTTP 500 failures across live and representative gates; npm publication remained skipped.
-- Extend the representative release matrices through `v1.0.0-rc.11`; RC.11 remains pending until OpenAI recovers and the distinct candidate completes every protected gate.
+- Record the protected RC.11 workflow's fail-closed first attempt, where one Qwen representative case returned `EXECUTION_FAILED`, Meta and OpenAI completed 14/14, Qwen completed 13/14, no unauthorized effects were observed, and npm publication remained skipped for that attempt.
+- Publish the complete second RC.11 attempt to `next` only after every deterministic, exact-artifact, OCI, live-provider, and representative gate passed from scratch; Meta, Qwen, and OpenAI each completed 14/14, and the registry artifact passed exact SHA-512 integrity plus SLSA provenance verification.
 
 ## 1.0.0-rc.10 - 2026-09-01
 

package/README.md

@@ -112,7 +112,7 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 Install the Node-first `0.11.1` artifact with an exact version:
 
 ```bash
-npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
+bunx @zhivex-ai/harness@0.11.1 --version
 ```
 
 To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
@@ -123,6 +123,16 @@ cp .env.example .env
 bun run dev --version
 ```
 
+The 1.0 source candidate adds a first-run setup that stores only a provider and model in an explicit personal profile:
+
+```bash
+bun run dev init --profile daily --provider openai
+bun run dev doctor --profile daily
+bun run dev --profile daily "inspect this repository"
+```
+
+Installed builds expose the same flow as `zhx init`. Profiles are private user configuration outside the repository, use owner-only permissions, contain no credentials, and are never selected implicitly. CLI flags override the selected profile; the selected profile overrides environment variables; environment variables override built-in defaults.
+
 Configure only the providers you plan to use:
 
 ```dotenv
@@ -140,6 +150,7 @@ GEMINI_API_KEY=...
 
 ```bash
 zhx doctor
+zhx doctor --profile daily
 zhx doctor --provider qwen --json
 ```
 
@@ -157,6 +168,13 @@ zhivex-harness --version
 
 Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
 
+The pending RC.13 source also adds Tab command completion, `/paste` for previewed
+multiline tasks, `/context` for active project rules/skills, and `/attach <path>` for
+bounded file excerpts. Ctrl+C interrupts active work while retaining the session;
+errors return to the prompt. See the [interactive workflow](./docs/CLI.md#interactive-daily-workflow)
+for attachment limits, approval behavior, and recovery. These source additions are
+not yet published or live-certified.
+
 Project context engineering is enabled by default. A root `AGENTS.md` plus an optional `.zhivex/harness.json` can declare bounded context files, rule files, and progressively loaded `SKILL.md` directories. Disable discovery with `--no-project-context` or select another manifest with `--context-config`.
 
 Show providers and detected configuration without printing secrets:

package/ROADMAP.md

@@ -355,7 +355,9 @@ Exit criteria:
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
 
-Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 records that immutable failure and makes the Qwen representative transport explicit while awaiting a green OpenAI precheck. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. GA remains blocked on the two open evidence classes in [`docs/ga-readiness.json`](./docs/ga-readiness.json): a later independent passing release candidate and the final-candidate security review.
+Release evidence checkpoint: RC.12 was published to npm `next` only after its exact protected workflow passed; RC.13 remains pending.
+
+Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 preserved its fail-closed first attempt, then reran every protected gate from scratch; Meta, Qwen, and OpenAI each completed 14/14 representative cases, and the exact validated artifact was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.12 then passed the complete deterministic, installed-artifact, OCI, live-provider, and three-provider representative matrix and was published to `next` with verified integrity and provenance. RC.13 is the distinct pending candidate for explicit first-run profiles and the session-only `doctor` correction; it has no release evidence until its exact tag completes the protected workflow. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. The required historical passing candidates are recorded; GA remains blocked on a current security review of the final candidate in [`docs/ga-readiness.json`](./docs/ga-readiness.json).
 
 Scope:
 
@@ -401,6 +403,6 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 1. Preserve RC.7's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence.
 2. Preserve RC.8 as an immutable failed attempt bound to its source-only tarball and protected run; do not move or reuse its tag.
 3. Preserve RC.9 and RC.10 as failed, unpublished attempts with their distinct failure evidence; do not move or reuse either tag.
-4. Complete RC.11 deterministic, installed-artifact, real-OCI and bounded provider prechecks before creating its exact annotated tag and entering the complete protected matrix.
+4. Preserve RC.11's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence, including its separate fail-closed first attempt.
 5. Complete the named security review against the final passing candidate and close every critical/high finding.
 6. Promote a separately tagged and verified `1.0.0` artifact to `latest` only after the release-mode readiness gate passes with two passing candidates.

package/SECURITY.md

@@ -20,7 +20,7 @@ The enabled no-cost public controls and the explicitly cost-gated features left
 
 ## Scope
 
-Reports are in scope when they affect packaged runtime code, workspace or state isolation, approval enforcement, secret handling, MCP boundaries, provider communication, dependency integrity, or the build and release pipeline.
+Reports are in scope when they affect packaged runtime code, personal-profile isolation, workspace or state isolation, approval enforcement, secret handling, MCP boundaries, provider communication, dependency integrity, or the build and release pipeline.
 
 The absence of an OS sandbox is a documented product boundary rather than a vulnerability by itself. The harness does not expose generic host shell or permanent-delete model tools.
 

package/contracts/public-api.json

@@ -105,6 +105,7 @@
     "cliChangeEnvelopeVerificationDocumentSchema",
     "cliDoctorDocumentSchema",
     "cliErrorDocumentSchema",
+    "cliInitDocumentSchema",
     "cliJsonDocumentSchema",
     "cliJsonLineDocumentSchema",
     "cliProviderDocumentSchema",
@@ -371,6 +372,7 @@
     "cliChangeEnvelopeVerificationDocumentSchema",
     "cliDoctorDocumentSchema",
     "cliErrorDocumentSchema",
+    "cliInitDocumentSchema",
     "cliProviderDocumentSchema",
     "cliReviewGroupDocumentSchema",
     "cliRunCancellationDocumentSchema",
@@ -459,6 +461,7 @@
     "CliChangeEnvelopeVerificationDocument",
     "CliCommandOptionContract",
     "CliCommandOptionContractKey",
+    "CliInitDocument",
     "CliJsonDocument",
     "CliJsonLineDocument",
     "CliOptionDefinition",
@@ -616,6 +619,7 @@
     "CliChangeEnvelopeVerificationDocument",
     "CliCommandOptionContract",
     "CliCommandOptionContractKey",
+    "CliInitDocument",
     "CliJsonDocument",
     "CliJsonLineDocument",
     "CliOptionDefinition",
@@ -787,6 +791,7 @@
   ],
   "cli": {
     "commands": [
+      "init",
       "run",
       "review",
       "chat",
@@ -836,10 +841,22 @@
       "doctorFailed": 3
     },
     "commandOptions": {
+      "init": {
+        "allowed": [
+          "--provider",
+          "--model",
+          "--profile",
+          "--json"
+        ],
+        "required": [],
+        "repeatable": [],
+        "conflicts": {}
+      },
       "run": {
         "allowed": [
           "--provider",
           "--model",
+          "--profile",
           "--route",
           "--workspace",
           "--state-dir",
@@ -909,6 +926,7 @@
         "allowed": [
           "--provider",
           "--model",
+          "--profile",
           "--route",
           "--workspace",
           "--state-dir",
@@ -942,6 +960,7 @@
         "allowed": [
           "--provider",
           "--model",
+          "--profile",
           "--route",
           "--workspace",
           "--state-dir",
@@ -1018,6 +1037,7 @@
         "allowed": [
           "--provider",
           "--model",
+          "--profile",
           "--workspace",
           "--state-dir",
           "--store",

package/contracts/security-controls.json

@@ -2,11 +2,12 @@
   "schemaVersion": 1,
   "targetVersion": "1.0.0",
   "controls": [
-    { "threat": "malicious-repository-context", "mitigations": ["bounded context files", "progressive skill loading", "digest-bound edits"], "evidence": ["tests/context-engineering.test.ts", "tests/edit-contracts.test.ts"], "residualRisk": "Trusted project instructions may influence model behavior within granted tool authority." },
-    { "threat": "compromised-model-or-provider", "mitigations": ["application-owned tools", "approval gates", "budgets", "redaction"], "evidence": ["tests/harness.test.ts", "tests/cli-stream.test.ts"], "residualRisk": "Provider receives prompts and may return adversarial content; operators must scope data and review approvals." },
+    { "threat": "malicious-repository-context", "mitigations": ["bounded context files", "progressive skill loading", "digest-bound edits", "descriptor-bound configuration reads"], "evidence": ["tests/context-engineering.test.ts", "tests/edit-contracts.test.ts", "tests/mcp.test.ts"], "residualRisk": "Trusted project instructions may influence model behavior within granted tool authority." },
+    { "threat": "compromised-model-or-provider", "mitigations": ["application-owned tools", "approval gates", "budgets", "redaction", "sensitive-path Git filtering"], "evidence": ["tests/harness.test.ts", "tests/cli-stream.test.ts", "tests/security.test.ts"], "residualRisk": "Provider receives prompts and may return adversarial content; operators must scope data and review approvals." },
     { "threat": "hostile-mcp-server", "mitigations": ["HTTPS or allowlisted loopback", "tool allowlists", "permissions", "bounded payloads"], "evidence": ["tests/mcp.test.ts", "scripts/mcp-interoperability-smoke.ts"], "residualRisk": "An approved remote MCP service can observe the inputs explicitly sent to it." },
     { "threat": "approval-replay-or-substitution", "mitigations": ["fingerprints", "exact proposal digests", "durable approval identity"], "evidence": ["tests/harness.test.ts", "tests/edit-contracts.test.ts"], "residualRisk": "Paused approvals require the original artifact and cannot be rebound across incompatible policy versions." },
     { "threat": "cross-scope-state-access", "mitigations": ["tenant/user/namespace scope", "workspace binding", "scoped hierarchy reads"], "evidence": ["tests/operations.test.ts", "tests/sessions.test.ts"], "residualRisk": "A process with direct filesystem access to the local state directory remains inside the trust boundary." },
+    { "threat": "tampered-personal-profile", "mitigations": ["explicit profile selection", "external user configuration", "owner-only permissions", "strict provider/model-only schema", "descriptor-bound no-follow reads"], "evidence": ["tests/cli-profiles.test.ts", "tests/cli.test.ts", "scripts/package-smoke.ts"], "residualRisk": "A compromised operator account or host filesystem can still replace the selected provider/model configuration." },
     { "threat": "hostile-subprocess", "mitigations": ["no-network OCI", "resource ceilings", "argv allowlist", "separate host import approval"], "evidence": ["tests/execution-environment.test.ts", "scripts/oci-execution-smoke.ts"], "residualRisk": "Containers are not VMs; the host kernel and OCI daemon are trusted." },
     { "threat": "crash-or-concurrent-writer", "mitigations": ["SQLite WAL", "optimistic revisions", "leases", "interrupted cleanup recovery"], "evidence": ["tests/operations.test.ts", "tests/execution-environment.test.ts"], "residualRisk": "Power loss and external filesystem corruption still require operator backup and recovery." },
     { "threat": "supply-chain-substitution", "mitigations": ["annotated tag", "immutable tarball", "SHA-512", "OIDC provenance", "pinned workflow actions"], "evidence": ["tests/release-workflow.test.ts", "scripts/check-release-artifact.ts", "scripts/release-provenance.ts"], "residualRisk": "Registry, GitHub, npm, and maintainer identities remain external trust dependencies." },

package/contracts/stable-api-signatures.json

@@ -13,7 +13,7 @@
     },
     {
       "name": "CLI_COMMAND_OPTION_CONTRACTS",
-      "sha256": "sha256:24b4f1884ff228de6027655bf75908e8267cfbf8852235971252bebe19581412"
+      "sha256": "sha256:aa09f2e5e3dc2061fa8171f78428b077f666776d49e78cddfbfc5d3e14ea3cf0"
     },
     {
       "name": "CLI_EVENT_SCHEMA_VERSION",
@@ -25,11 +25,11 @@
     },
     {
       "name": "CLI_OPTION_DEFINITIONS",
-      "sha256": "sha256:e9f6878dc5cf6a6d82f902fb6157db0f65932234ca69ed7f87e89f3dbb4811de"
+      "sha256": "sha256:80643d92df0424a8c5ecd67900b658a5fc67cda7bc857bdd36583f37eb33f508"
     },
     {
       "name": "CLI_OPTION_NAMES",
-      "sha256": "sha256:72f3b2f6a13b1bed6977b8d0ac43327246efb492b99ec5975a7c9e6b81196723"
+      "sha256": "sha256:ff63e6dcc9cff7b9d369457d2d5f40021e7ab05f59eb7ea8bf512cf165fafe12"
     },
     {
       "name": "DEFAULT_ALLOWED_CHECKS",
@@ -145,7 +145,7 @@
     },
     {
       "name": "cliJsonDocumentSchema",
-      "sha256": "sha256:2a18f15adcf6d11745eb8499e1a458afc6d47f17e5d9820711a3157e348acbe0"
+      "sha256": "sha256:6d6d32f289af541f437c6632f82360be9a6cae43faa16942505aedb8ca602c37"
     },
     {
       "name": "cliJsonLineDocumentSchema",
@@ -245,7 +245,7 @@
     },
     {
       "name": "parseCliJsonDocument",
-      "sha256": "sha256:fedf61cd4fc0a83eebf113af3771b3e8eb8148fb9c3961d34ddfc2386b453de4"
+      "sha256": "sha256:88171752f13fd7f031d27152eaa7c49048a78fd3f857f31565bff62a251b8537"
     },
     {
       "name": "parseCliJsonLineDocument",
@@ -289,7 +289,7 @@
     },
     {
       "name": "validateCliCommandOptions",
-      "sha256": "sha256:0db6291eaea426f120f5ee900cc0c0332007e7897587f49ac5f5b8f23cde209a"
+      "sha256": "sha256:0ecaa9569b797d3a26c23b9473b80a98e5d94925e8ecae4aef937e96be357fb8"
     },
     {
       "name": "verifyChangeEnvelope",
@@ -311,11 +311,15 @@
     },
     {
       "name": "CliCommandOptionContractKey",
-      "sha256": "sha256:ebba6d15bf9d4d4a1f556c49f82a13f60791825574662f58b228372265b82437"
+      "sha256": "sha256:e69ffd0ea0af23a143a85b6d596d710bbdf607e9474657547dfb83fa69c78cbd"
+    },
+    {
+      "name": "CliInitDocument",
+      "sha256": "sha256:bd8de48830fffc5a4479974bbba6ccf36911a84de41d858e50d2d9cee056489c"
     },
     {
       "name": "CliJsonDocument",
-      "sha256": "sha256:819decd0ff5969a9e534c0da940fd498896343b932e17f3c2712a584a7d5251d"
+      "sha256": "sha256:69d773fc769a1a3c0e4657dd18e486feb6a42c999c9b490874841e4330ddf0e5"
     },
     {
       "name": "CliJsonLineDocument",
@@ -327,7 +331,7 @@
     },
     {
       "name": "CliOptionName",
-      "sha256": "sha256:650c835c1b9dafc111608dc5214b555b2b0527442f2bdfc2d42ef74d0d306208"
+      "sha256": "sha256:6af106bfbfd758333ef524ef32e44f29429651bfc837bbaad647609a93a1e6ca"
     },
     {
       "name": "CliReviewGroupDocument",
@@ -486,5 +490,5 @@
       "sha256": "sha256:b165b5eb63b24371c7ab1ca83b95a9c553e7200aa89e94306ca4a7434eb1bb39"
     }
   ],
-  "digest": "sha256:834bf8631b3e549da9ff2641050082dd2601898a7b7a1efa7d20511b82f3dd0d"
+  "digest": "sha256:b89e3786cd87b50506c3dc75dc8cf332a7c266974dc1a76611757531d8c49840"
 }

package/dist/cli-options.d.ts

@@ -8,10 +8,11 @@ export interface CliCommandOptionContract {
     repeatable: readonly string[];
     conflicts: Readonly<Record<string, readonly string[]>>;
 }
-export declare const CLI_OPTION_NAMES: readonly ["--provider", "--model", "--route", "--workspace", "--state-dir", "--mcp-config", "--context-config", "--no-project-context", "--patch", "--preconditions", "--now", "--execution", "--oci-runtime", "--oci-image", "--oci-allow-command", "--oci-shell", "--oci-max-process-runtime-ms", "--oci-max-process-output-bytes", "--oci-max-memory-mb", "--oci-max-pids", "--oci-max-cpus", "--oci-max-workspace-bytes", "--oci-max-file-write-bytes", "--oci-tmpfs-mb", "--store", "--tenant", "--user", "--namespace", "--idempotency-key", "--max-steps", "--timeout-ms", "--max-tool-calls", "--max-tool-errors", "--max-input-tokens", "--max-output-tokens", "--max-total-tokens", "--subagent-max-steps", "--subagent-max-tool-calls", "--subagent-max-tool-errors", "--subagent-max-input-tokens", "--subagent-max-output-tokens", "--subagent-max-total-tokens", "--subagent-timeout-ms", "--max-parallel-reviews", "--max-cost-usd", "--input-cost-per-million", "--output-cost-per-million", "--allow-check", "--require-capability", "--subagent", "--reviewer", "--yes", "--approve", "--deny", "--json", "--jsonl", "--session", "--continue", "--status", "--limit", "--cursor", "--before", "--reason", "--cascade", "--final", "--apply", "--help", "--version"];
+export declare const CLI_OPTION_NAMES: readonly ["--provider", "--model", "--profile", "--route", "--workspace", "--state-dir", "--mcp-config", "--context-config", "--no-project-context", "--patch", "--preconditions", "--now", "--execution", "--oci-runtime", "--oci-image", "--oci-allow-command", "--oci-shell", "--oci-max-process-runtime-ms", "--oci-max-process-output-bytes", "--oci-max-memory-mb", "--oci-max-pids", "--oci-max-cpus", "--oci-max-workspace-bytes", "--oci-max-file-write-bytes", "--oci-tmpfs-mb", "--store", "--tenant", "--user", "--namespace", "--idempotency-key", "--max-steps", "--timeout-ms", "--max-tool-calls", "--max-tool-errors", "--max-input-tokens", "--max-output-tokens", "--max-total-tokens", "--subagent-max-steps", "--subagent-max-tool-calls", "--subagent-max-tool-errors", "--subagent-max-input-tokens", "--subagent-max-output-tokens", "--subagent-max-total-tokens", "--subagent-timeout-ms", "--max-parallel-reviews", "--max-cost-usd", "--input-cost-per-million", "--output-cost-per-million", "--allow-check", "--require-capability", "--subagent", "--reviewer", "--yes", "--approve", "--deny", "--json", "--jsonl", "--session", "--continue", "--status", "--limit", "--cursor", "--before", "--reason", "--cascade", "--final", "--apply", "--help", "--version"];
 export type CliOptionName = (typeof CLI_OPTION_NAMES)[number];
 export declare const CLI_OPTION_DEFINITIONS: Readonly<Record<CliOptionName, CliOptionDefinition>>;
 export declare const CLI_COMMAND_OPTION_CONTRACTS: {
+    readonly init: CliCommandOptionContract;
     readonly run: CliCommandOptionContract;
     readonly review: CliCommandOptionContract;
     readonly chat: CliCommandOptionContract;

package/dist/cli-profiles.d.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { type HarnessConfigInput, type HarnessProvider } from "./config.js";
+export declare const CLI_PROFILE_SCHEMA_VERSION: 1;
+export declare const CLI_PROFILE_CONFIG_DIRECTORY_ENV: "ZHIVEX_HARNESS_CONFIG_DIR";
+export declare const MAX_CLI_PROFILE_BYTES: number;
+export declare const cliProfileSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    provider: z.ZodEnum<{
+        meta: "meta";
+        qwen: "qwen";
+        openai: "openai";
+        gemini: "gemini";
+    }>;
+    model: z.ZodString;
+}, z.core.$strict>;
+export type CliProfile = z.infer<typeof cliProfileSchema>;
+export interface CliProfilePathContext {
+    env?: NodeJS.ProcessEnv;
+    homeDirectory?: string;
+    platform?: NodeJS.Platform;
+}
+export declare const validateCliProfileName: (name: string) => string;
+export declare const resolveCliProfileConfigDirectory: (context?: CliProfilePathContext) => string;
+export declare const resolveCliProfilePath: (name: string, context?: CliProfilePathContext) => string;
+export declare const loadCliProfile: (name: string, context?: CliProfilePathContext) => Promise<CliProfile>;
+export declare const createCliProfile: (name: string, input: {
+    provider: HarnessProvider;
+    model: string;
+}, context?: CliProfilePathContext) => Promise<{
+    path: string;
+    profile: {
+        schemaVersion: 1;
+        provider: "meta" | "qwen" | "openai" | "gemini";
+        model: string;
+    };
+}>;
+export declare const applyCliProfile: <T extends HarnessConfigInput & {
+    profile?: string;
+}>(options: T, context?: CliProfilePathContext) => Promise<T>;

package/dist/cli.d.ts

@@ -18,7 +18,7 @@ export declare const CLI_EXIT_CODES: {
 export declare const annotateCliStreamError: (error: unknown, lastSequence: number | undefined) => Error;
 export declare const cliStreamErrorSequence: (error: unknown) => number;
 export declare const terminalErrorMessage: (error: unknown) => string;
-export declare const CLI_COMMANDS: readonly ["run", "review", "chat", "providers", "doctor", "resume", "runs", "sessions", "changes", "state", "help", "version"];
+export declare const CLI_COMMANDS: readonly ["init", "run", "review", "chat", "providers", "doctor", "resume", "runs", "sessions", "changes", "state", "help", "version"];
 export declare const CLI_RUNS_COMMANDS: readonly ["list", "inspect", "cancel", "cleanup", "export"];
 export declare const CLI_SESSIONS_COMMANDS: readonly ["list", "inspect", "rename", "fork", "archive"];
 export declare const CLI_CHANGES_COMMANDS: readonly ["create", "verify"];
@@ -30,6 +30,7 @@ type ChangesCommand = (typeof CLI_CHANGES_COMMANDS)[number];
 type StateCommand = (typeof CLI_STATE_COMMANDS)[number];
 export interface CliOptions {
     command: Command;
+    profile?: string;
     provider?: string;
     model?: string;
     workspace?: string;